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EXAMINER'S AMENDMENT 

1 . An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

2. Authorization for this examiner's amendment was given in a telephone interview 
with L. Alan Collins on June 1 1 , 2009. 

3. The application has been amended as follows: 

4. Please do not enter claim amendments dated 5/5/2009. 

5. Please amend the claims as follows: 
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In the claims: 

1-33. (Canceled) 

34. (Previously Presented) A dynamic email spam analysis and management system comprising: 
a database including a plurality of spam rules, each of the plurality of spam rules having 

attributes including a score; 

a spam analyzer operable to process a log file received from each of a plurality of message 
switches, each message switch processing an email against each of the plurality of spam rules thus 
determining if the processed email will be marked as spam, and for each match between the 
processed email and each of the plurality of spam rules, each message switch creating an entry in its 
log file corresponding to the processed email and the matching spam rule wherein each entry includes 
the score from each matching spam rule, the spam analyzer operable to update the attributes of at 
least one of the plurality of spam rules in the database, the updating including modifying the score of 
the at least one of the plurality of spam rules, the updating based on statistics calculated from at least 
one of the log files, wherein the spam analyzer is distinct from each of the plurality of message 
switches, and wherein each of the plurality of message switches are software being executed on one of 
a plurality of mail servers; and 

a select rules file including one or more select rules from the database of the plurality of spam 
rules, each of the one or more select rules being included in the select rules file based on its 
attributes, the select rules file being replicated to each of the message switches. 

35. (Previously Presented) The system of claim 34 wherein the spam analyzer processes each log 
file to determine how many times each of the plurality of spam rules was hit and accordingly updates 
the attributes corresponding to the each of the plurality of spam rules. 

36. (Previously Presented) The system of claim 34 wherein the attributes corresponding to each of 
the plurality of spam rules are updated to indicate how many times each of the plurality of spam rules 
was false-positive-hit. 

37. (Previously Presented) The system of claim 34 wherein one or more other select rules of the 
plurality of spam rules are retired, each of the one or more other select rules being retired based on its 
attributes. 
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38. (Previously Presented) The system of claim 37 wherein the one or more other select rules have 
not been hit within a predetermined amount of time. 

39. (Previously Presented) The system of claim 34 wherein the select rules file further includes one 
or more new rules. 

40. (Previously Presented) The system of claim 34 wherein the spam analyzer calculates, based on 
information derived from the log file, how many times each of the plurality of spam rules was hit. 

41 . (Previously Presented) The system of claim 34 wherein the attributes of each of the plurality of 
spam rules are modified to indicate how many times each of the plurality of spam rules was false- 
positive-hit. 

42. (Previously Presented) The system of claim 34 wherein the spam analyzer calculates, based on 
information derived from the log file, how many hits of each of the plurality of spam rules was 
determined to be for spam email messages and accordingly modifies the corresponding attributes of 
the each of the plurality of spam rules. 

43. (Previously Presented) The system of claim 34 wherein the spam analyzer calculates based on 
information derived from the log file, how many hits of each of the plurality of spam rules was 
determined to be for non-spam email messages and accordingly modifies the corresponding 
attributes of the each of the plurality of spam rules. 

44. (Previously Presented) The system of claim 34 wherein the score of one of the plurality of spam 
rules is modified manually. 

45. (Currently Amended) A dynamic email spam analysis and management system comprising: 
a message switch including a spam filter operable to receive an email message wherein the 
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message switch is one of a plurality of message switches that are each software being executed on one 
of a plurality of mail servers comprising a conventional server ; and 

a select rules file including a plurality of spam rules, each of the plurality of spam rules having 
attributes including a score, wherein the spam filter analyzes the email message to determine if the 
email message will be marked as spam wherein the analyzing includes creating an entry in a log file, 
the entry including the score from each of the plurality of spam rules that matches the email message, 
and wherein the message switch periodically communicates the contents of the log file to a central 
server and periodically receives an updated select rules file from the central server, the updated select 
rules file differing from the select rules file, and the updated select rules file becoming the select rules 
file once received, and wherein the central server is distinct from each of the plurality of message 
switches. 

46. (Canceled) 

47. (Previously Presented) The system of claim 45 wherein a total spam score for the email 
message is modified using the score of each of the plurality of spam rules for which there is a hit on 
the email message. 

48. (Previously Presented) The system of claim 47 wherein, if the total spam score exceeds a score 
threshold, the email message is identified as a spam email message. 

49. (Previously Presented) The system of claim 45 wherein each of the plurality of spam rules has 
attributes including one or more of: a date and time the spam rule was last updated, number of hits, 
number of spam hits, number of non-spam hits, and date and time of last hit. 



50. (Previously Presented) The system of claim 47 wherein, if the total spam score does not exceed 
a score threshold, the email message is identified as a non-spam email message. 
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51 . (Previously Presented) The system of claim 50 wherein the email message is transferred to an 
intended recipient. 

52. (Previously Presented) The system of claim 45 wherein each of the plurality of spam rules are 
constructed using regular expressions. 

5 3. (Previously Presented) A method for dynamically updating spam rules, the method comprising: 

receiving an email message at a message switch wherein the message switch is one of a 
plurality of message switches that are each software being executed on one of a plurality of mail 
servers; 

processing the email message against the spam rules to determine if the email message will be 
marked as spam, each of the spam rules having attributes including a score; 

creating a spam information entry in a log file, the spam information entry including the score 
from each of the spam rules that the processed email message matches; 

calculating statistics for the spam rules based on the spam information in the log file; 

updating a database of the spam rules based on the statistics, the updating including 
modifying the score of at least one of the spam rules; 

selecting a set of select rules from the database of the updated spam rules to form a select 
rules set; and 

replicating the select rules set to the message switch wherein the select rules set, once 
received by the message switch, becomes the spam rules. 

54-55. (Canceled) 

56. (Currently Amended) The method of claim [[55]] 53 wherein the processing includes testing 
the email message against each of the spam rules for a hit and, if a hit exists for the each of the spam 
rules, modifying a total spam score of the email message based on the score of the each of the spam 
rules. 
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57. (Previously Presented) The method of claim 56 wherein the spam information entry 
corresponding to the email message in the log file includes an identifier for each of the spam rules for 
which there was a hit. 

58. (Previously Presented) The method of claim 5 3 wherein the calculating includes calculating, 
based on the log file, how many times each of the spam rules was hit. 

59. (Previously Presented) The method of claim 53 wherein the calculating includes calculating, 
based on the log file, how many hits for each of the spam rules were for a spam email message versus 
a non-spam email message. 

60. (Previously Presented) The method of claim 53 wherein the updating includes updating a 
quantity of false-positive-hits for one or more of the spam rules. 

61 . (Previously Presented) The method of claim 5 3 wherein the selecting includes retiring one or 
more of the spam rules wherein the retired spam rules are not included in the select rules set. 

62. (Currently Amended) The method of claim [[55]] 53 wherein the updating includes updating 
the score of one or more of the spam rules based on the statistics. 

63. (Currently Amended) The method of claim [[55]] 53 wherein the score of each of the spam 
rules can be modified manually. 

64. (Previously Presented) The method of claim 5 3 wherein the replicating includes replicating the 
select rules set to each of the plurality of message switches. 

65. (Previously Presented) The method of claim 5 3 further comprising, if the email message is 
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determined to be a non-spam email message, transferring the email message to an intended recipient. 

66. (Previously Presented) The method of claim 5 3 embodied as computer-executable instructions 
stored on a computer-readable medium. 
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Allowable Subject Matter 

6. Claims 34-45, 47-53, and 56-66 are allowed. For reasons for allowance, see 
Office Action dated 2/5/2009. The rejection of claims 45 and 47-52 has been removed in 
view of Applicant's instant amended claims and Applicant's statements made in 
Applicant's response dated 5/5/2009. 

7. Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Conclusion 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to GRANT FORD whose telephone number is (571)272- 
8630. The examiner can normally be reached on 8-5:30 Mon-Thurs alternating Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571)272-3868. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Andrew Caldwell/ 

Supervisory Patent Examiner, Art 

Unit 2442 

/G. F./ 

Examiner, Art Unit 2442 



